6437c006-1d86-4cdc-89d5-23305f207e3a

Details

ID	`6437c006-1d86-4cdc-89d5-23305f207e3a`
Provider	Proofpoint
Category	Data Enrichment & Threat Intelligence
From Version	6.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

PhishUp prevents phishing attacks, protects your staff and your brand with AI

If you don’t have PhishUp Api Key please create an account on PhishUp and get a free Api Key.
Also you can visit and test PhishUp Web Demo.

If you have any question feel free to concat us: info@phishup.com

Configure PhishUp in Cortex

Parameter	Description	Required
API KEY		True
Incident type		False
Trust any certificate (not secure)		False
Use system proxy settings		False
PhishUp Playbook Actions	If there is any Phishing activity in mail, what should PhishUp do?	True

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

url

PhishUp Url investigation

Base Command

url

Input

Argument Name	Description	Required
Url	URL for phishup investigation.	Required

Context Output

Path	Type	Description
PhishUp.Url	String	Incoming Url
PhishUp.Result	String	response types “Clean”, “Phish”
PhishUp.Score	Number	Phishup Engine Url Score
DBotScore.Indicator	String	The indicator that was tested.
DBotScore.Type	String	The indicator type.
DBotScore.Vendor	String	The vendor used to calculate the score.
DBotScore.Score	Number	The actual score.
URL.Data	String	The URL

Base Command

phishup-get-chosen-action

Input

There are no input arguments for this command.

Context Output

Path	Type	Description
PhishUp.Action	String	Chosen action from PhishUp instance

Base Command

phishup-evaluate-response

Input

There are no input arguments for this command.

Context Output

Path	Type	Description
PhishUp.Evaluation	String	Evaluating PhishUp Results and Return Phish If There is an Phish Website

Configuration parameters

credentials — (required)
incidentType — Incident type
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
phishup-playbook-action — PhishUp Playbook Actions (required)
integrationReliability — Source Reliability
feedExpirationPolicy —
feedExpirationInterval —

Commands (3)

phishup-evaluate-response
Evaluation PhishUp URLs Response.
phishup-get-chosen-action
Get chosen action from PhishUp instance.
url
Url for PhishUp Reputation Investigation.

Source

PhishUp.py PhishUp_test.py PhishUp.yml PhishUp_description.md command_examples.txt

Download History Raw

import json

from pytest import raises  # noqa: PT013

MOCK_APIKEY = "not"
MOCK_PARAMS = {"credentials": {"password": MOCK_APIKEY}}

BASE_URL = "https://apiv2.phishup.co"


def util_load_json(path):
    with open(path, encoding="utf-8") as f:
        return json.loads(f.read())


def test_investigate_url_authentication_error(requests_mock):
    from PhishUp import Client, investigate_url_command

    requests_mock.post(
        f"{BASE_URL}/sherlock/investigate?apikey={MOCK_APIKEY}", json=util_load_json("test_data/authentication_error.json")
    )
    client = Client(base_url=BASE_URL, verify=False)
    args = {"url": ["https://www.paloaltonetworkscom/"]}
    with raises(Exception, match="PhishUp"):
        investigate_url_command(client, args, MOCK_APIKEY)


def test_investigate_url_command_empty_url_list_error(requests_mock):
    from PhishUp import Client, investigate_url_command

    requests_mock.post(
        f"{BASE_URL}/sherlock/investigate?apikey={MOCK_APIKEY}", json=util_load_json("test_data/authentication_error.json")
    )
    client = Client(base_url=BASE_URL, verify=False)
    args = {"Url": []}
    with raises(Exception, match="Empty URLs list"):
        investigate_url_command(client, args, MOCK_APIKEY)


def test_success_investigate_url_command(requests_mock):
    from PhishUp import Client, investigate_url_command

    requests_mock.post(
        f"{BASE_URL}/sherlock/investigate?apikey={MOCK_APIKEY}",
        json=util_load_json("test_data/investigate_api_successful_response.json"),
    )
    client = Client(base_url=BASE_URL, verify=False)
    args = {"url": "https://www.paloaltonetworks.com/"}
    response = investigate_url_command(client, args, MOCK_APIKEY)
    assert response[0].outputs == util_load_json("test_data/investigate-success-outputs.json")
    assert response[0].raw_response == util_load_json("test_data/investigate-success-raw-response.json")


def test_get_chosen_nothing_phishup_action_command():
    from PhishUp import get_chosen_phishup_action_command

    params = {"phishup-playbook-action": "Nothing"}
    result = get_chosen_phishup_action_command(params)
    assert result.__dict__["outputs"] == {"PhishUp.Action": "Nothing"}
    assert result.__dict__["raw_response"] == "Nothing"
    assert result.__dict__["readable_output"] == "Chosen Action: Nothing"


def test_auth_success_test_module(requests_mock):
    from PhishUp import Client, test_module

    requests_mock.post(
        f"{BASE_URL}/auth-service/ValidateApiKey?apikey={MOCK_APIKEY}", json={"Status": {"Result": "Success", "Message": ""}}
    )
    client = Client(base_url=BASE_URL, verify=False)
    r = test_module(client, apikey=MOCK_APIKEY)
    assert r == "ok"


def test_auth_error_test_module(requests_mock, mocker):
    from PhishUp import main

    patcher = mocker.patch("demistomock.command", return_value="test-module")
    patcher_mock_params = mocker.patch("demistomock.params", return_value=MOCK_PARAMS)
    patcher_mock_params.start()
    patcher.start()
    requests_mock.post(
        f"{BASE_URL}/auth-service/ValidateApiKey?apikey={MOCK_APIKEY}",
        json={"Status": {"Result": "Error", "Message": "Authentication Error"}},
    )
    response = main()
    assert response is None